feat(ntfy): support HTTP Basic auth alongside access tokens

Self-hosted ntfy that doesn't expose a token-mint endpoint can still
authenticate over HTTP Basic. Add Username + Password fields to
NtfyConfig; the channel sends 'Authorization: Basic …' when token is
empty and username is set. Token wins when both are configured.

Form-side: two new optional fields next to the access token, with
the same write-only placeholder treatment as smtp_password (blank
on edit means 'keep stored value'). Username is round-tripped on
edit; password is masked.

web/templates/pages/settings.html

@@ -271,7 +271,20 @@
             <label class="field-label" for="nt-token">Access token <span class="text-ink-fade font-normal">· optional</span></label>
             <input id="nt-token" name="ntfy_access_token" type="password" class="field mono"
                    placeholder="{{if and $isEdit (eq $f.Kind "ntfy")}}tk_… · stored, leave blank to keep{{else}}tk_… · required for protected topics{{end}}" />
-            <div class="field-help">Required for protected topics on self-hosted ntfy.</div>
+            <div class="field-help">Use this OR username+password below. Token wins when both are set.</div>
+          </div>
+          <div class="grid grid-cols-2 gap-3.5">
+            <div>
+              <label class="field-label" for="nt-user">Username <span class="text-ink-fade font-normal">· optional</span></label>
+              <input id="nt-user" name="ntfy_username" type="text" class="field mono"
+                     value="{{$f.NtfyUsername}}" placeholder="ntfy basic-auth user" />
+            </div>
+            <div>
+              <label class="field-label" for="nt-pass">Password <span class="text-ink-fade font-normal">· optional</span></label>
+              <input id="nt-pass" name="ntfy_password" type="password" class="field mono"
+                     placeholder="{{if and $isEdit (eq $f.Kind "ntfy")}}stored, leave blank to keep{{else}}ntfy basic-auth password{{end}}" />
+              <div class="field-help">Sent as HTTP Basic auth when no token is set.</div>
+            </div>
           </div>
           <div>
             <label class="field-label" for="nt-priority">Default priority</label>